c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4

Resubmissions

30/08/2023, 23:51

29/08/2023, 18:38

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 23:51

Target

c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
Size

664KB
MD5

04bcbc084757b3dc87cdc158372207d8
SHA1

0eae3faac86b067e268f95313bd9c651a2187c64
SHA256

c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4
SHA512

e6de6a50253d986c4e76fb42935a2268d1a1c6811df7e66544267c24138ee43f56ce2b45c9aa0e24ec57afe5f5128cc1288a2f2d38603fa93cfd26a39ca8487d
SSDEEP

12288:uJdoCUhRcOJ5cY7Jg9oC9f0viSM/vb/F0weXFEUFFDeP69cu6lDy:uf5yP29oviSM/v7eDeF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 3444	4796	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
3444	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3444	4796	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	90
PID 4796 wrote to memory of 3444	4796	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	90
PID 4796 wrote to memory of 3444	4796	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	90
PID 4796 wrote to memory of 3444	4796	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	90
PID 4796 wrote to memory of 3444	4796	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	90
PID 4796 wrote to memory of 3444	4796	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	90

C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
"C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
  "C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444

memory/3444-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3444-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3444-12-0x00000000017C0000-0x0000000001B0A000-memory.dmp

Filesize
3.3MB

Download
memory/4796-3-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/4796-4-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/4796-5-0x0000000004FE0000-0x0000000004FEA000-memory.dmp

Filesize
40KB

Download
memory/4796-6-0x0000000005220000-0x00000000052BC000-memory.dmp

Filesize
624KB

Download
memory/4796-7-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4796-8-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/4796-0-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4796-11-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/4796-2-0x00000000055E0000-0x0000000005B84000-memory.dmp

Filesize
5.6MB

Download
memory/4796-1-0x00000000004B0000-0x000000000055A000-memory.dmp

Filesize
680KB

Download